Juniper NetScreen
IPSec Dial Client
Installation Guide for
Windows 2000 ®
Windows XP ®
Windows Vista ®
Revision 2.0
1 Overview... 1
2 System Requirements ... 1
3 Installing the Client ... 1
4 Verifying and Disabling Windows Firewall ... 13
5 Uninstalling the Client ... 16
6 Importing a Policy ... 22
1 Overview
This document gives detailed procedures including captured screen shots for end users to install and uninstall IPSec Dial Client on their PC. The final section of the document includes the instructions required to import the customer-specific security policy that contains the VPN connectivity information. Contact your company’s contact to obtain your SafeNet security policy.
2 System Requirements
Operating system: Juniper NetScreen- Remote VPN Client 10.8.3 Build 6.
Windows 2000*
Windows XP*
Windows Vista*
Disk space: 10 MB
RAM: 64MB for Windows 2000 and Windows XP
Minimum CPU: Pentium 200
Warning:
All other IPSec clients (e.g., Nortel Contivity or Cisco Unity clients) should be removed prior to installation of the SafeNet client. Any previous versions of SafeNet should be removed before starting the installation of the new version. Multiple IPSec clients existing on the same PC may cause serious problems, including system crash.
In the event of a third party personal firewall software is used in the Windows XP environment instead of the Windows firewall, it is recommended that the Windows firewall be turned off to avoid a possible conflict. It also allows the proper operation of the third party personal firewall.
Also after uninstalling the previous version of SafeNet SoftRemote client software the system must be rebooted. In Windows XP with Service Pack 2, ensure that the Windows firewall is turned off prior to installing the new release of the SafeNet SoftRemote client software. Then enable it after the installation completes. This applies to the case where there is no third party personal firewall enabled or active.
Step 1: Select “RUN” on the “NetScreenRemoteVPNClient_V10.8.3.Build_6.exe” icon to execute the installation process. Click on NEXT to continue on the following screen
Step 2: Click on NEXT to continue on the above screen
Step 3: When license agreement screen appears, select “YES” to continue.
Step 4: Select “TYPICAL” in the NetScreen-Remote Setup screen and then select “NEXT”
Step 5: At the InstallShield Wizard window, click Next.
Step 6: Once Wizard has completed installation of files, the PC will automatically reboot.
Step 7: When PC boots up, the NetScreen IPSec Dial Client icon should appear in the Windows System Tray. The IPSec Dial Client can be switched on and off by right clicking on the icon in the System Tray and selecting Activate or Deactivate from the menu. The IPSec Dial Client should be deactivated until the Security Policy has been imported.
The IPSec Dial Client is now successfully installed.
Step 11: In order to access Windows network resources (WINS resolution, file sharing), NetBIOS protocol may need to be enabled on the NetScreen virtual adaptor. This applies to all Windows operating systems. For most versions of Windows 2000, go to your “Network and Dial-up Connections” and select “properties’ on the NetScreen virtual adaptor using right-click button on the mouse and then select “Networking.” The virtual adaptor might not appear until a VPN connection is attempted. If installed, check “File and Print Sharing for Microsoft Networks” and “Client for Microsoft Networks.”
Highlight “Internet Protocol (TCP/IP)” and select “Properties.” Then select “Advanced” and you should see the screen capture depicted on the next page. Select the Tab “WINS” and check the appropriate boxes shown above. Then select OK and exit back out completely.
Highlight “Internet Protocol (TCP/IP)” and select “Properties.” Then select “Advanced” and you should see the screen capture depicted below. Select the tab “WINS” and check the appropriate boxes shown. Then select OK and exit back out completely.
To enable the default route on Windows 2000, go to your “Network and Dial-up Connections” and select “properties” on the SafeNet virtual adaptor using the right-click button on the mouse and choose “Networking.” The virtual adaptor might not appear until a VPN connection is attempted.
Highlight Internet Protocol (TCP/IP) and select “Properties” and choose the Tab “Advanced.”
Then select the “General” tab and check Use default gateway on remote network.
Caution! When not using your connection to the VPN, the session should be properly disconnected and de-activated. Using “right-click” mouse button on NetScreen icon , select “disconnect all”
and then “deactivate security policy”, both in the same menu. If you shut down the PC without deactivating the policy, the session would stay active and you may not be able to use the Windows login at the next start up.
4 Verifying and Disabling Windows Firewall
In the client PC, a personal firewall can be active at a time to avoid a possible conflict. In the event of a third party personal firewall is used instead of the Windows XP firewall, the Windows firewall
Step 5: Click on Windows Firewall to verify if it is disabled or not
It should be turned off if a third party personal firewall is present and active.
5 Uninstalling the Client
Step 1: Open up the Windows Control Panel by clicking Start Settings Control Panel.
Double-click the Add/Remove Programs icon.
Step 2: For Windows 2000 and Windows XP, the following window is shown. Click on the Change or Remove icon in the Add/Remove Programs Window, Click to highlight IPSec Dial Client, and then click on Change/Remove to uninstall.
For Vista:
Step 3: Check the Remove option when the InstallShield Wizard window is displayed, then click Next to continue the uninstall process.
For Vista:
Step 4: Click OK when prompted with the following message to confirm the uninstall.
Click Yes when prompted with the following message box to completely remove the client. Click No is you are upgrading to a new version of the SafeNet IPSec Dial Client since you will need to re- import the security policy.
Step 5: When the Maintenance Complete window is shown, click Finish to restart the PC and complete uninstalling the IPSec Dial Client.
Step 6: When the PC boots up, the IPSec Dial Client icon should not appear in the Windows System Tray. The IPSec Dial client has been removed from the PC.
6 Importing a Policy
In order to connect to your company’s network, you must instruct the IPSec Dial client how to establish this connection. This information is contained in a policy that is imported into the Dial Client.
Confirm that the SafeNet SoftRemote IPSec Dial Client is installed on your PC. The IPSec Dial Client icon (either if it’s activated or if it’s deactivated) will appear in the Windows System Tray if the client is installed. If the client has not been installed, refer to the Installation Guide for Windows 98/NT/2000/XP users.
You will need to obtain a policy from your company’s administrator. The policy file will have the extension “.spd” (e.g., NewPolicy.spd). Note the directory where you save the policy file (e.g., C:\Data, C:\My Documents, or the Windows Desktop).
Before importing a policy, the client needs to be activated. It is already activated if the Dial Client icon looks like . If it does not, right click on the icon and select Activate Security Policy from the menu.
Step 1: Double-click on the activated IPSec Dial Client icon located in the Windows System Tray to open up the IPSec Dial Client’s “Security Policy Editor” window. Choose File from the Menu Bar and select Import Security Policy.
Step 2: From the “Import policy from…” window, locate the policy file in the directory where you saved it (e.g., C:\Data, C:\My Documents, or the Windows Desktop). Highlight the policy file then click Open to import the policy.
Step 3: Click Yes to confirm selection of the policy and continue the importation process.
For Vista:
Step 5: Click File on the Menu Bar and select Save Changes to put policy in effect or generate interesting traffic using a web browser or ping.
